Is it legal to use JDBC code inside the business methods of an Entity Bean? What are the implications of doing so?

Yes it is allowed. The implications rather depend on your bean and your application. The biggest implication is in your transactions: if you call your entity business methods directly from a client, each method will be executed as its own transaction, so you can expect ejbLoad, your business method, and ejbStore to all be called for each method. This tends to be a lot of datbase activity, which is why guys like me advocate the Ssession wraps Entity' pattern. See this FAQ for more details on 'Session wraps Entity'

Another potential problem rises from doing this within a CMP entity bean: you have to be careful not to modify tables behind the container's back: containers are allowed to cache CMP entity data (the spec defines three 'commit options', A, B, and C) and modifying the tables directly can cause the container's cache to be inconsistent in some cases.

With BMP beans the situation is simpler, and making JDBC calls from normal business methods can allow you to optimize your application in some situations. For example, if your application's object model consists of a few very coarse grained entities that each have several sets of dependent objects, you can use a 'lazy fetch' implementation to retrieve dependents only when you know they're going to be used.